1. Field of the Invention
The invention generally relates to controlling access to a software application and, more particularly, controlling access to a first software application using a second trusted application.
2. Background
When deploying servers (e.g., lightweight directory access protocol (LDAP) directories) in large enterprises, efficient write-access and update management become major issues. For example, in a network enterprise system, LDAP control implementations typically require that an Access Control List (ACL) for an entry be stored in that entry. The single LDAP master directory handles receiving and propagating all changes and propagating them to replica servers. LDAP master servers typically handle write requests, and replica servers typically handle read requests. In a LDAP directory with a large audience, this may result in the ACLs consuming more space than the actual data. This increase in data and the processing of the ACLs reduces the speed at which the LDAP master can process updates which, in turn, exacerbates response time and overall speed of processing. In certain situations the LDAP master becomes so busy processing incoming change requests that propagation of the changes to replicas is impacted. To accommodate processing requests, LDAP products have access control mechanisms, but they are typically very fine-grained and tend to be susceptible to overall performance degradation as demands increase. As entries in the master LDAP directory increase, performance and response times degrade.
Access to ACL lists is typically restricted to certain users or applications. Thus, granting individual users access to the ACL list is uncommon. However, if users are granted the ability to update their own data in the ACL, an ACL for the owner for each entry would have to be created. For example, if there are currently 350,000 entries, allowing each user to update their own data would necessitate doubling the number of entries in the directory, in this example, to 700,000 entries. This would create undesired overhead on the LDAP directory processing.
Thus, granting users the ability to update their own data in an ACL, for example, to permit a user the ability to update for example, phone/FAX/tieline data, may create undesirable impediments to ACL processing. However, if a solution may be implemented to avoid this undesired overhead on the master LDAP server, then updates to user data by users may be performed without undue performance degradation.
Additionally, current LDAP masters typically service all requests for ACL updates, regardless of the requestor's identity or type of modification being performed on the ACL. Authentication of the requester and validating the entitlement of the requestor before permitting access to the ACL must be performed for every request. The function of validating entitlement and authenticating the requester is a significant overhead task that is built into the traditional functions of the LDAP master which contributes to slow response times and unacceptable performance issues. Therefore, allowing increased numbers of users access to the ACL list significantly increases overhead since their accesses must also be authenticated and entitlement validated. Further, updates to a LDAP directory are typically a synchronous operation and if the attempt fails, retries are necessary to complete the update. These updates may involve significant complexity or overhead.